A network switch appliance may be configured to receive packets from a network, and pass packets to one or more network instruments downstream through one or more ports at the network switch appliance. In some cases, a user of the network switch appliance may configure the network switch appliance to perform in a certain manner. For example, the user may create a logical connection between an ingress port and an egress port to deliver traffic to certain instrument for analysis. The user may also apply filters to reduce the traffic that are sent to the instrument.